iPhone app unable to login when hosted on WebFaction.

alatteri commented 13 years ago

OpenVBX hosted on webfaction, iPhone app unable to login. mod_rewrite is enabled both on the host and in OpenVBX config tab.

These are the questions that WebFaction tech support asks.. they are eager to help:

We need more details. What headers exactly? What URL is the access happening on? Is it a GET or POST?

chadsmith commented 13 years ago

Are you using v0.9.0 or above?

alatteri commented 13 years ago

yes. .91

minddog commented 13 years ago

Hey Alatteri,

Is there a way you can dump the headers that openvbx is receiving on an API call from the iPhone?

alatteri commented 13 years ago

If you tell me how, happy to do it.

Sent from my iPhone

On Apr 11, 2011, at 22:40, minddog reply@reply.github.com wrote:

Hey Alatteri,

Is there a way you can dump the headers that openvbx is receiving on an API call from the iPhone?

Reply to this email directly or view it on GitHub: https://github.com/twilio/OpenVBX/issues/122#comment_987837

mkerner commented 12 years ago

Curious if there is any resolution to this. I'm having the problem on WebFaction with 1.2.5

alatteri commented 12 years ago

I ditched wf and host on media temple.

Sent from my iPhone

On Feb 16, 2012, at 14:32, mkerner reply@reply.github.com wrote:

Curious if there is any resolution to this. I'm having the problem on WebFaction with 1.2.5

Reply to this email directly or view it on GitHub: https://github.com/twilio/OpenVBX/issues/122#issuecomment-4011020

ntemple commented 12 years ago

I don't have an iPhone or WF hosting account, but here's some ideas on how to debug ...

Add to the application (index.php) something like:

file_put_contents('/tmp/weblog.txt', print_r($GLOBALS, true), FILE_APPEND | LOCK_EX);

This will give you log everything sent to the app, so could get big, fast.

You'll want to try to login with the iPhone App, and then turn off (delete or comment out) the line above. Also hit the website itself at least once so you know that your getting things logged.

That will give you the log.

If you don't see anything from the app, then there's a chance it's never getting to OpenVBX ... being diverted by mod_security or a similar system.

Do you know if WF has the suhosin patch enabled? I've read that can muck with PHP sessions, which could affect the iPhone app as well.

mkerner commented 12 years ago

It looks like the app is connecting to the server just fine and that sessions are working. In looking through the log file it doesn't look like there are any post/get/request variables being sent from the app that are related to the login.

Any ideas where to look next?

**

[_POST] => Array
    (
    )

[HTTP_POST_VARS] => Array
    (
    )

[_GET] => Array
    (
        [vbxsite] => messages/inbox
    )

[HTTP_GET_VARS] => Array
    (
        [vbxsite] => messages/inbox
    )
[_REQUEST] => Array
    (
        [vbxsite] => messages/inbox
        [openvbx_session] => a:4:{s:10:"session_id";s:32:"fa03c1bc1570f47712863b05e4fb6653";s:10:"ip_address";s:13:"70.243.110.99";s:10:"user_agent";s:45:"OpenVBX/1.0.2 CFNetwork/548.0.4 Darwin/11.0.0";s:13:"last_activity";s:10:"1329580697";}01b5f3b83d0026f55a91039f2a8bbd86
    )

ntemple commented 12 years ago

Good to know that the app is being hit. VBXLoginController does show that messages/inbox is the first url to be hit. [ http://github.com/ntemple/OpenVBX-iPhone/blob/master/Classes/VBXLoginController.m , line ~95 ]

Could you post the _SERVER array? That would have the useragent, raw cookie string, exact URL's posted to etc ... before PHP has a chance to munge them.

Also, try clearing the log, logging out and logging in again. There's a long comment in the source of the App about needing to remove credentials, I'm almost wondering if for some reason it's not doing this and using "old" credentials.

Another thing to review ...

the app works on other hosts, but not this one?
any ideas what could be different? Specifically looking at Apache config, run mode (CGI vs mod_php, etc), how sessions / cookies are handled, etc.
is the suhosin patch being used? That can muck with sessions in Flash, I'm wondering if the same thing isn't being done here.

On Sat, Feb 18, 2012 at 11:04 AM, mkerner reply@reply.github.com wrote:

It looks like the app is connecting to the server just fine and that sessions are working. In looking through the log file it doesn't look like there are any post/get/request variables being sent from the app that are related to the login.

Any ideas where to look next?

**

[_POST] => Array ( )

[HTTP_POST_VARS] => Array ( )

[_GET] => Array ( [vbxsite] => messages/inbox )

[HTTP_GET_VARS] => Array ( [vbxsite] => messages/inbox ) [_REQUEST] => Array ( [vbxsite] => messages/inbox [openvbx_session] => a:4:{s:10:"session_id";s:32:"fa03c1bc1570f47712863b05e4fb6653";s:10:"ip_address";s:13:"70.243.110.99";s:10:"user_agent";s:45:"OpenVBX/1.0.2 CFNetwork/548.0.4 Darwin/11.0.0";s:13:"last_activity";s:10:"1329580697";}01b5f3b83d0026f55a91039f2a8bbd86 )

Reply to this email directly or view it on GitHub: https://github.com/twilio/OpenVBX/issues/122#issuecomment-4035023

mkerner commented 12 years ago

I've never been able to login from the iPhone app. Are you saying that it could be using credentials from a browser session on my laptop? I have tried logging in from other machines and all are capable of getting into vbx. I'm guessing the app works with other hosts, I don't have another one to try.

I'll check with WF on the other issues.

ntemple commented 12 years ago

I'm thinking that maybe a redirect from one domain to another is confusing the system with some sort of cacheing. What version of OpenVBX are you using?

I'm seeing specific issues / bug fixes around php-cgi mode, also around login changes in the iPhone app - I'm wondering if any of these re relevent. I now have acces to an iPhone so am doing some of my own testing.

mkerner commented 12 years ago

It's 1.2.5 r74. There shouldn't be any redirects happening on this install.

ntemple commented 12 years ago

Redirects are still used quite few places in the code, especially during login - small changes in host fields can call cookies to be dropped.

Here's what I'm seeing from the app:

Step 1: 74.134.12.199 - - [19/Feb/2012:01:37:20 +0000] "GET /client?with_i18n=1&type=iphone HTTP/1.1" 200 1682 "-" "OpenVBX/1.0.2 CFNetwork/485.12.7 Darwin/10.4.0"

I'm not sure what this call is intended to do, but it won't work without mod_rewrite enabled. Is mod_rewrite enabled on your server?

Step 2: The next call is for the inbox: 74.134.12.199 - - [19/Feb/2012:01:38:59 +0000] "GET /messages/inbox HTTP/1.1" 401 1174 "-" "OpenVBX/1.0.2 CFNetwork/485.12.7 Darwin/10.4.0"

I assume this returns with a request for credentials, because the next request re-sends with HTTP BASIC authentication:

Step 3: 74.134.12.199 - nick@example.com [19/Feb/2012:01:38:59 +0000] "GET /messages/inbox HTTP/1.1" 200 1843 "-" "OpenVBX/1.0.2 CFNetwork/485.12.7 Darwin/10.4.0"

(these match up perfectly with my weblog.txt log)

At that point, I get a new session cookie with my username and userid embedded and can successfully use the app. A comment in the code implies mod_rewrite is also required for this to work with CGI mode.

http://github.com/twilio/OpenVBX/blob/master/OpenVBX/libraries/User_Controller.php (See line 235)

Do you see a similar series of calls by the app? Your looking for logs, above, and / or PHP_AUTH_USER in the SERVER array.

mkerner commented 12 years ago

To the best of my knowledge mod_rewrite is functioning properly (it is with other sites on the same server and the rewrite rules in the VBX .htaccess file don't cause errors).

I see that same series of calls, but never see the PHP_AUTH_USER in the php dump. I do get a new session started after the second step, but there isn't any auth info included within the session.

mkerner commented 12 years ago

When I look at the dump after using the browser it shows all of the proper information.

Any guesses about which of the rewrite rules should be active? (although I've tried both)

    RewriteRule ^(.*) index.php?vbxsite=$1 [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L,QSA]
    #RewriteRule ^(.*) index.php/$1 [L,QSA]

ntemple commented 12 years ago

It looks like WebFaction has an extremely complicated setup, and how it is setup depends on your server node as well as other factors. http://docs.webfaction.com/software/php.html

My suggestion at this point is to contact their customer support and let them help. We can help provide as much information as they need, and the logs should help. There's something basic missing here, either in the redirect auth or missing / incorrect server variables. I can't immediately tell what it is.

Once we get this working for you, we can document the process.

On Sat, Feb 18, 2012 at 10:24 PM, mkerner reply@reply.github.com wrote:

When I look at the dump after using the browser it shows all of the proper information.

Any guesses about which of the rewrite rules should be active? (although I've tried both)

RewriteRule ^(._) index.php?vbxsite=$1 [E=HTTPAUTHORIZATION:%{HTTP:Authorization},L,QSA] #RewriteRule ^(.) index.php/$1 [L,QSA]

Reply to this email directly or view it on GitHub: https://github.com/twilio/OpenVBX/issues/122#issuecomment-4039422

twilio / OpenVBX

iPhone app unable to login when hosted on WebFaction. #122